Unable to find the id of the group 'default'

[doc dodo]

Hello,

2026/07/17 13:56:27 wazuh-db: WARNING: The groups were empty right after the set for agent '072'

2026/07/17 13:56:27 wazuh-db: WARNING: Unable to find the id of the group 'default'

2026/07/17 13:56:27 wazuh-db: ERROR: There was an error assigning the groups to agent '140'

If I try to create this group I recieve next error:

/var/ossec/bin/agent_groups -a -f -g default
Do you want to create the group 'default'? [y/N]: y
Error 1711: The group already exists: default

But default isn't in group list:

/var/ossec/bin/agent_groups -l
Groups (2):
  soc_01 (0)
  soc_02 (13)

How can I recreate this group?

[hariha...@wazuh.com]

Hi Doc dodo,

To help identify why the default group exists but is not listed, could you please provide the following information?

• Wazuh version and whether this was after a recent upgrade? (wazuh-control info)

• Is this a single-node deployment or a cluster? If it's a cluster, are you running these commands on the master or a worker node?

• Does the default shared configuration directory exist?

  ls -ld /var/ossec/etc/shared/default

• Could you check whether the default group exists in the global database?

  sqlite3 /var/ossec/queue/db/global.db "SELECT name FROM 'group';"

Additionally, if possible:

• What happened immediately before these errors started (e.g., upgrade, crash, disk full, manual file changes, restore from backup)?

• Do you have a backup of global.db or the /var/ossec/etc/shared/ directory?

Regards,

Harihar Singh

Wazuh Inc.

[doc dodo]

The problem arose a long time ago, after moving to another server, but we only noticed the errors in the log now.

Sorry, but I haven't a backup of global.d.

1 .Wazuh version and whether this was after a recent upgrade? (wazuh-control info)

/var/ossec/bin/wazuh-control info

WAZUH_VERSION="v4.14.5"
WAZUH_REVISION="rc1"

WAZUH_TYPE="server"

2.  Is this a single-node deployment or a cluster? If it's a cluster, are you running these commands on the master or a worker node?

I have cluster with docker multi node and I run the command on master node.

3.  Does the default shared configuration directory exist?

ls -ld /var/ossec/etc/shared/default
ls: cannot access '/var/ossec/etc/shared/default': No such file or directory

4.  Could you check whether the default group exists in the global database?

sqlite3  global.db "SELECT name FROM 'group';"
soc_01
soc_02

пятница, 17 июля 2026 г. в 14:41:31 UTC+3, hariha...@wazuh.com: